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In realistic continuous variable quantum key distribution protocols, an eavesdropper may exploit the addi- 
tional Gaussian noise generated during transmission to mask her presence. We present a theoretical framework 
for a post-selection based protocol which explicitly takes into account excess Gaussian noise. We derive a 
quantitative expression of the secret key rates based on the Levitin and Holevo bounds. We experimentally 
demonstrate that the post-selection based scheme is still secure against both individual and collective Gaussian 
attacks in the presence of this excess noise. 
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Continuous variable quantum key distribution (CV-QKD) 
^ was introduced as an alternative to the original discrete 
variable single photon schemes f?]. CV-QKD promises to of- 
fer higher secret key rates, better detection efficiencies and 
higher bandwidths than its single photon counterpart and is 
easily adapted to current communication systems. Currently 
the two main protocols in CV-QKD are post-selection (PS) |3] 
and reverse reconciliation (RR) [4]. These protocols are based 
on the random Gaussian modulation of coherent states using 
either homodyne [4] or heterodyne [5J detection and both have 
been experimentally demonstrated Ji , H d, [gl [l^l ■ At present 
PS-based CV-QKD has practical advantages in terms of key 
distillation and has been demonstrated experimentally for up 
to 90% channel loss fl. 

Reverse reconciliation CV-QKD, due to its inherent nature, 
easily incorporates excess noise into the protocols, and secu- 
rity proof have been demonstrated in the case of individual 
Gaussian attac ks |i4j , jsl], non-Gaussian attacks lllll . collec- 
tive attacks lll2lll3[l (with their Gaussian optimality il4ll ) and 
coherent states using homodyne detection |15t]. For PS CV- 
QKD, the addition of excess noise into the analysis is quite 
difficult. The original protocol |3] only considered pure or 
vacuum states in its scheme and so far all post-selection pro- 
tocols since have concentrated on the unrealistic case of zero 
excess noise f3[S[l2tl- Recently however, excess noise using 
a hybrid protocol, consisting of both post-selection and either 
direct or reverse reconciliation, was considered for the case of 
collective attacks lIlSll . 

In this paper, we present a protocol for calculating the effect 
of excess Gaussian noise (EGN) on post-selection where two 
way classical communication is permitted, and show its secu- 
rity when considering either individual or collective attacks. 
We apply our analysis to an experimental demonstration and 
conclude that good key rates can be obtained under the realis- 
tic condition of channel with loss and excess Gaussian noise. 

We extend the original PS CV-QKD protocol [3] as fol- 
lows. The sender, Alice draws two random numbers and 
from Gaussian distributions of variances and re- 
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FIG. 1: (color online). Schematic of setup. Quantum channel of 
transmission rj and excess noise ^ is simulated experimentally (a) and 
analyzed theoretically for the entangling doner attack (b). A/2: half 
waveplate; PBS: polarizing beam-splitter; AM/PM: amplitude/phase 
modulators; RNG: independent white noise generators; EPR: Entan- 
glement source; Q-mem: quantum memory. 



spectively, which she encodes on the amplitude (x) and phase 
(p) of a coherent beam. Each encoding {S^, S'^) represent a 
pair of bits whose value is fixed by the sign of the encoding. 
The modulated Gaussian beam is then transmitted to the re- 
ceiver. Bob, through a lossy and noisy Gaussian channel with 
transmission rj and variance of EGN ^. Bob receives a Gaus- 
sian mixed state ps with variance Vg'^ ~ r/V^'^ + l + C. and 
then randomly measures either the amplitude rrig or phase 
TO^ quadratures of this mixed state. As both amplitude and 
phase play the same role, we will only explicitly consider one 
quadrature for the rest of this paper, and denote Alice's encod- 
ing and Bob's measurement as Sa and respectively. The 
probability that Bob measures a particular value ms given 
that Alice used a particular encoding Sa is given by the con- 
ditional probability. 
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where Vv is the variance of the vacuum noise. Note that in 
this paper the vacuum noise is normahzed to = 1. The 
error rate in Bob deciding whether AUce encoded positively 
or negatively is thus given by 
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The mutual information rate between Alice and Bob is given 
as a function of this error probability using the Shannon for- 
mula yjj /yis = $(1 - 2Pe) where 

= ^ [(1 + log2(l +X) + {1-X) log2(l - X)] (3) 

Bob then informs Alice over a public channel which quadra- 
ture he measured and at what time interval. Alice and Bob 
then both announce the absolute values of their encodings 
\Sa\ and measurement results |tob| respectively. This is in 
contrast to previous zero excess noise protocols where only 
Alice announces her absolute value |i3s,i7J. Alice and Bob then 
post-select information for which they have a mutual infor- 
mation advantage over Eve and discard information for which 
they do not. Alice and Bob also choose a random subset of 
data to characterize the channel loss 77, the EGN ^ and check 
that the statistics are Gaussian. Finally Alice and Bob use a 
two way reconciliation algorithm to reconcile their data. 

As with any type of eavesdropping attack, we assume any 
EGN on the quantum channel is always attributed to, and con- 
trolled by, the eavesdropper. Eve. The fact that there exists ex- 
cess noise on the channel allows Eve to be entangled to Bob. 
There exists a known upper bound ^ < 2ri fl^ to the amount 
of EGN ^ that can be added on a channel of transmission 7/ 
above which Alice and Bob's quantum correlation cease to 
exist P] . We consider here the entangling doner attack which 
has been shown optimal for PS CVQKD with collective at- 
tacks in the presence of EGN H. The entangling doner at- 
tack (see Fig.[T](b)) consists of Eve replacing the lossy line 
by a beam splitter of transmission 77 where one of the inputs is 
Alice's initial state in a quadrature basis given by 
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and the second input is one arm of an entangled state Eve has 
created given by 
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where 1/2 (K, + 1/K) = (1 -7/ + ^) /(I-77) is the variance 
of the entangled beam she injects to simulate the EGN ^. Eve 
keeps one of the entangled beams (denoted Ei) and one of 
the outputs of the beam splitter (denoted E2) while she sends 
the remaining output to Bob (denoted B) through a perfect 
noiseless and lossless line. When Bob performs his homodyne 



measurement and announces its absolute value \mB\, Eve's 
state collapses to one of the four possible pure state given by 
\'4'b) El E2' where the superscript a = 0, 1 refers to Alice's 
encoded bit and the subscript 6 = 0, 1 to Bob's measured bit. 
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Note that this state is not normalised, (ipl'ip) — PmslSA gi'^^n 
by Eq. ([T]l. The amount of secure bits that Alice and Bob 
can extract for each transmission is given by max{0, Iab — 
maxj/AB, I be}}- Eve chooses to maximise her information 
with either Alice or Bob depending on which will give her 
the greater information. If Eve decides to attack Alice, she 
needs to distinguish between the states ~ (i/'g| + 
li'i) ("01 1- To attack Bob, she needs to distinguish between 
the states p''be^W)W\ + \'^1){'^1\- 

The inner products between these states can be computed 
explicitly by performing the Gaussian integrations in Eq. 
For example, the four terms that distinguishes Eve's input for 
attacking Alice from her inputs for attacking Bob are: 
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We see that at the critical value of 777,^ — 



1 + ?-'? C , oil 

(i+5)2_i'3a, ail 
the above inner products are equal. Eve's input state for at- 
tacking Alice is unitarily equivalent to that for attacking Bob, 
and hence her accessible information with Alice is exactly the 
same as with Bob: Iae ~ I be- When ms > m'^. Eve would 
gain more information by attacking Bob while below this line 
she stands to gain more by attacking Alice. 

Given Eve's two input states, we need to find her accessible 
information. If this is smaller than Iab, Alice and Bob keep 
the bit and distill a key from it. Our task now is to find Eve's 
accessible information for such states. We bound this infor- 
mation from above for both individual and collective attacks. 

A bound on Eve's accessible information I^^ in the case 
of individual attacks is calculated by providing her with the 
knowledge on whether Alice and Bob's bit values match or 
not. With this information. Eve's input is reduced to two pure 
states. Her accessible information is bounded by 
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where pi is the probability that Alice and Bob obtains the 
same bits and p2 is the probability that their bits differ, and 
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are the normalised inner products between the states that Eve 
distinguishes [20,1. We note that this bound corresponds to the 
Levitin bound as given in ^ for the case of no added noise. 
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FIG. 2: (color online). Post-selection regions at 77 = 0.6 are shown in 
red. Figures (a) and (b) show the information rates A/ — Iab ~ Ie 
with no excess noise for individual and collective attacks. Figures (c) 
and (d) is when ^ = 0.2. On the dashed line m% in figure (c), Eve can 
obtain the same amount of information from Alice as she can from 
Bob. The post-selection region asymptotes to the lines m'g. 



value of V^^* such that the weighted integral over the positive 
information region 51 given below is maximised. 

A/(^.-)= f p{SA,rnB){lAB - I^E"^)dmBdSA (12) 

In principle, as long as the post-selection region is non- 
empty, Alice and Bob can always distill a finite amount of 
key. At a certain noise threshold however, we expect that there 
will be no more post-selectable region. This is clear for ^ = 2 77 
il^, since then the state between Alice and Bob becomes sep- 
arable. In this case. Eve can do an intercept and resend attack 
in which Ie > Iab for aU values of Sa and tub- 

But even before the separability limit is reached, the post- 
selectable region may become empty. To analyse this, we 
consider the case when Sa is large. In such a case, Alice 
and Bob would share the same bits with a high probability. 
Eve's accessible information then tends to $ (^\/^ — fi^- In 
this limit. Eve's input becomes ever closer to being just two 
classical pure states and so Holevo's bound would tend to the 
same limiting information. Equating this with Iab, we obtain 
two solutions for m^o ■ 



In other words, the region of post-selectibility asymptotes to 
these two lines as Sa increases (see Fig.|2l). The noise thresh- 
old ^0 over which the quantum channel is insecure is ob- 
tained when the two lines and coincide such that 
there is no more region of post-selectibility. This occurs when 
77(1 +?o)"= 6(^0 + 2)(Co + l-^). 
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We apply Holevo's theorem [,2 1,1 on Eve's input states, pE, 
to bound Eve's information in terms of the von Neumann en- 
tropy, S{p), and obtain the amount of information I^'^' acces- 
sible by Eve when performin collective attacks 

- Sipl + Pe)- S{2p%)/2 - S{2p\)l2 (11) 

Figure (O shows the difference in mutual information from 
Bob's point of view when Alice announces Sa for a fixed 
value of rj and ^. For each 77 and ^, Alice then chooses the 



FIG. 3: (color online). Experimental results superimposed on theo- 
retical lower bounds of secure key rates at transmission r) = 0.47 ± 
0.002 when Eve does a collective attack and an individual attack 
(inset). Unfilled data points with arrows have error bars going to 
negative AJ. The shaded region indicates the noise threshold for se- 
cure keys. The experimental results were obtained using an encoding 
variance optimized for the individual attack bound. 

Fig- Uta) shows the schematic of our experiment. In this 
setup we encoded keys on the amplitude quadrature and sim- 
ulated the loss of the line by using a variable attenuator and 
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the added noise by adding a random Gaussian signal onto the 
ampUtude quadrature on AHce's ampHtude modulator. The 
transmitted light is detected using a homodyne detection setup 
at Bob's station. The two sets of time series, Alice's encoding 
Sa and Bob's measurement were analysed using the tools 
developed in |01. We note that extraction of the final key can 
be performed using the methods described in |7] with an av- 
erage efficiency of 2 to 4 % for all datasets with positive raw 
information rates A/. 

Figure [3] shows experimental results superimposed onto 
theoretical bounds of total post-selected information rates 
AI — Iab — Ie 31 channel transmission ?/ = 47% for indi- 
vidual and collective attacks, as a function of channel EGN ^. 
The experimental mutual information rate between Alice and 
Bob Iab is calculated by comparing the two signal-processed 
time series and nig. This quantity is less than the theoret- 
ical calculation due to experimental imperfections associated 
with the encoding (e.g. non-optimum encoding variance), de- 
tection (e.g. homodyne inefficiency) and signal processing. 
Experimental uncertainty is calculated for Iab due to the fi- 
nite number of data points. The information rate for Eve Ie is 
calculated theoretically, with error bars in Ie calculated using 
the uncertainties in channel transmission, EGN and Alice's 
variance Va- 

The experimental data points A/cxp are in good agreement 
with the theoretical results. For some of the higher EGN cases, 
the error bars extend towards the negative region. It should be 
emphasized however, that this is mainly due to the finite num- 
ber of collected data that results in statistical uncertainties. In 
our experiment, 2.4MBits of data were taken per run. The 
theoretical curves for AI in Fig. [3] monotonically decreases 
until they reach exactly zero at the security threshold line. No 
secure keys can be generated in the shaded region. 
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FIG. 4: (color online). Experimental results superimposed on theo- 
retical contour plots of information rate after post-selection (AI) as a 
function of channel transmission r\ and EGN ^. (a),(b),(c),(d),(e) in- 
dicates A/ = 10"\ 10"^ 10~^ 10^*, 10~^ Filled (unfilled) data 
points indicate A/cxp > (A/oxp < 0). No secure keys can be 
generated in the shaded regions. Dark shade indicates separability 
between Alice's and Bob's states. 



Fig.|4]shows the experimental results superimposed on con- 
tour plots of AI as a function of 77 and ^. Three sets of ex- 
perimental runs were taken for r\K, 0.2,0.5,0.8. Filled and 
unfilled data points indicate A/cxp > and A/exp < respec- 
tively. We obtained positive information rates for 77 — 0.2 for 
^ = 0.1. In principle, lower 77 is attainable; the experimental 
demonstration for such cases is left for future work. 

In conclusion, we have extended the original post-selection 
protocol 1 3] to take into account the effect of channel EGN for 
individual and collective Gaussian attacks by an eavesdropper 
In both cases, we find that the scheme is still secure. We have 
also presented an experimental demonstration, which verifies 
for the first time that continuous variable quantum cryptogra- 
phy using post-selection is secure in the presence of channel 
loss as well as EGN. This is important since realistic laser 
sources and optical fibers lit] inevitably inherit EGN. Reana- 
lyzing our results from 101 using the theory presented in this 
paper we conclude that the small amount of EGN present in 
that experiment would have had negligible effect on the key 
rates if properly accounted for. 
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